The global nightmare of ransomware shows no sign of slowing down, with the volume of mobile ransomware rising 3.5 times during the first few months of the year, according to IT security firm Kaspersky Lab. In its latest report, the Moscow-based firm said the number of mobile ransomware files detected reached 218,625 during the quarter, compared to 61,832 in the previous quarter, with the Congur family accounting for more than 86%. Ransomware targeting all devices, systems and networks also continued to grow, with 11 new cryptor families and 55,679 new modifications making their appearance in Q1. Congur ransomware is primarily a blocker – setting or resetting the device PIN (passcode) so it requires the attackers to have administrator rights on the device, and some variants of the malware take further advantage of these rights to install their module into the system folder from where it is almost impossible to remove.
Despite the popularity of Congur, Trojan-Ransom.AndroidOS.Fusob.h remained the most widely used mobile ransomware, accounting for nearly 45% of all users attacked by this threat during the period. Once run, the Trojan requests administrator privileges, collects information about the device, including GPS coordinates and call history, and uploads the data to a malicious server. Based on what it receives, the server may send back a command to block the device.
“The mobile threat landscape for ransomware was far from calm in quarter one. Ransomware targeting mobile devices soared, with new ransomware families and modifications continue to proliferate. Attackers can—and will—try to block access to their data not only on a PC but also on their mobile device,” notes Roman Unuchek, senior malware analyst, Kaspersky Lab.
The report stated that the company has detected and repelled around 480 million malicious attacks from online resources located in 190 countries and almost 80 million unique URLs were recognised as malicious by web antivirus components. Also, attempted infections by malware that aims to steal money via online access to bank accounts were registered on 288,000 user computers. Crypto-ransomware attacks were blocked on 240,799 computers of unique users.
To reduce the risk of infection, Kaspersky recommends using robust security solutions and making sure all software is kept updated and a system scan is run regularly to check for possible infection. It asks internet users to stay wise while online and avoid entering personal information into a website if they are unsure or suspicious. It also suggested to create a back up of all valuable information.